Layer 2 Bridge: How It Forwards Ethernet Traffic

A Layer 2 bridge forwards Ethernet traffic by learning which MAC addresses are reachable on each of its ports and then selectively relaying frames only to the port where the destination device lives. It does this transparently to the connected hosts, using the destination MAC address in each frame to make a forwarding decision, and flooding frames only when the address is unknown or is a broadcast.

Background: Why Bridges Exist

Before bridges, networks were built with hubs, which simply repeated every incoming signal out of every other port. That meant all devices shared the same collision domain, and only one device could transmit at a time. Bridges were introduced to split a network into separate collision domains while keeping it as a single logical network. A bridge examines the source and destination MAC addresses in each Ethernet frame and forwards it only where it needs to go, so traffic on one segment does not consume bandwidth on another.

Modern switches are essentially multi-port bridges. The term “bridge� is still used in software contexts, such as Linux bridging or virtual machine network bridges, but the forwarding logic is identical. Understanding how a bridge forwards traffic is the same as understanding how a basic Ethernet switch works.

How a Bridge Learns MAC Addresses

A bridge starts with an empty forwarding table. As frames arrive, it reads the source MAC address and records it against the port the frame came in on. This is called MAC learning. The table is also called a CAM table (Content-Addressable Memory) or FDB (Forwarding Database).

Each entry has a timestamp, and entries that are not refreshed within a certain aging time (typically 300 seconds) are removed. This allows the bridge to adapt when devices move or are unplugged. The learning process is automatic and requires no configuration.

For example, when a computer with MAC address 00:11:22:33:44:55 sends a frame to a server, the bridge notes that 00:11:22:33:44:55 is on port 1. The next time a frame is destined to that MAC, the bridge knows to send it out port 1 only.

Forwarding Decision: Unicast, Broadcast, Unknown

When a frame arrives, the bridge looks up the destination MAC address in its forwarding table. There are three possible outcomes:

• Known unicast: The destination MAC is in the table. The bridge forwards the frame only out of the port associated with that MAC. This is the most efficient path.
• Unknown unicast: The destination MAC is not in the table. The bridge floods the frame out of all ports except the one it arrived on. The device will reply, and then the bridge learns its location.
• Broadcast/multicast: The destination MAC is FF:FF:FF:FF:FF:FF (broadcast) or a multicast address. The bridge floods the frame out of all ports except the ingress port, because the frame is intended for many devices.

This flooding behavior is necessary for protocols like ARP, which uses broadcast to find a device’s MAC address. Once the target replies, the bridge learns its MAC and subsequent traffic is forwarded only to that port.

Port States and the Spanning Tree Protocol

If a network has redundant links, a bridge can forward frames in a loop, causing broadcast storms and duplicate frames. The Spanning Tree Protocol (STP) prevents this by placing some ports in a blocking state. STP elects a root bridge and determines the shortest path to it, disabling ports that are not on that path.

Ports can be in one of several states:

• Blocking: No frames are forwarded, but the port still listens for BPDUs (Bridge Protocol Data Units) to detect topology changes.
• Listening: The port is preparing to forward, but only processes BPDUs.
• Learning: The port learns MAC addresses but does not forward frames.
• Forwarding: Normal operation – frames are forwarded and MAC learning occurs.
• Disabled: The port is administratively down.

STP is essential in any network with more than one path between switches. Without it, the bridge would forward frames in an endless loop, quickly saturating the network.

VLANs and Tagged Traffic

A bridge can be configured to support VLANs (Virtual Local Area Networks). Each port is assigned to a VLAN, and the bridge only forwards frames between ports in the same VLAN. This isolates broadcast domains and can improve security and performance.

When a frame crosses a trunk link (a link between switches that carries multiple VLANs), it is tagged with a VLAN ID using the 802.1Q standard. The bridge reads the tag and forwards the frame only to ports that are members of that VLAN. The forwarding decision is based on both the destination MAC and the VLAN ID.

For example, a bridge with ports 1-4 in VLAN 10 and ports 5-8 in VLAN 20 will never forward a frame from port 1 to port 5, even if the destination MAC is known, because they are in different VLANs.

Common Problems and Misconceptions

One common misconception is that a bridge filters traffic based on IP addresses. It does not – it works entirely at Layer 2, using MAC addresses. IP addresses are irrelevant to the forwarding decision.

Another issue is MAC table overflow. If a bridge receives frames from too many unique source MAC addresses, its forwarding table can fill up. When the table is full, the bridge may start flooding all frames, which can degrade performance. This can be a security concern, as an attacker could intentionally flood the table to force a hub-like behavior.

Also, asymmetric routing can cause problems. If a device sends traffic to a bridge on one port and receives replies on another (because of multiple paths), the bridge may not learn the correct port for the source MAC. This is rare in simple networks but can happen in complex setups.

How to Choose a Bridge or Switch

When selecting a bridge or switch, consider the following:

• Port count: How many devices do you need to connect?
• Speed: 100 Mbps, 1 Gbps, 10 Gbps – choose according to your devices and bandwidth needs.
• Managed vs. unmanaged: Managed switches support VLANs, STP, and monitoring; unmanaged are plug-and-play but offer no configuration.
• PoE (Power over Ethernet): If you have IP cameras or VoIP phones, you may want PoE to power them over the same cable.
• Form factor: Desktop, rack-mounted, or industrial – depends on where you’ll place it.

For a home network, an unmanaged switch is usually sufficient. For a business, a managed switch gives you control over VLANs and redundancy.

Costs and Alternatives

Bridges and switches are generally inexpensive compared to routers. A basic 5-port gigabit switch costs very little, while managed enterprise switches can be more expensive. The cost is mostly determined by port count, speed, and management features.

Alternatives to a bridge include:

• Hub: Simpler but inefficient – no MAC learning, all traffic is flooded.
• Router: Operates at Layer 3, forwarding packets based on IP addresses, and can connect different networks.
• Wireless access point: Bridges wireless clients to the wired network, but is not a general-purpose bridge.

For virtual environments, software bridges (like Linux bridge or Open vSwitch) provide the same functionality without dedicated hardware.

Frequently Asked Questions

What is the difference between a bridge and a switch?

Functionally, they are the same. A switch is a multi-port bridge. The term “bridge� often refers to a two-port device, while a switch has many ports, but the forwarding logic is identical.

Does a bridge forward broadcast frames?

Yes. Broadcast frames (destination MAC FF:FF:FF:FF:FF:FF) are flooded out of all ports except the one they arrived on. This is necessary for protocols like ARP to work.

Can a bridge connect two different network speeds?

Yes, a bridge can have ports of different speeds (e.g., one 100 Mbps and one 1 Gbps). It will forward frames between them, but the overall throughput will be limited by the slower port.

What happens if a bridge receives a frame with a destination MAC that is not in its table?

It floods the frame out of all ports except the ingress port. The device will eventually respond, and the bridge will learn its MAC address for future frames.

How does a bridge handle a frame with the same source and destination MAC?

If the source and destination MAC are on the same port, the bridge will discard the frame because it does not need to forward it to another port. This is called filtering.

Is a bridge the same as a repeater?

No. A repeater simply regenerates the signal and forwards it out all ports, creating one collision domain. A bridge makes forwarding decisions based on MAC addresses and separates collision domains.

Related

• Choosing a Humidifier for a Walk-In Humidor
• Share Web Content Fast with Cortex: What It Means
• Google Earth Flight Simulator: How to Use It